Shodan Queries
Source: https://github.com/jakejarvis/awesome-shodan-queries at
b3439d187b03
License: CC0-1.0
Read the English original
Awesome Shodan Search Queries 
Section titled “Awesome Shodan Search Queries ”Over time, I’ve collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.
Most search filters require a Shodan account.
You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren’t! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.
The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t — and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.
And as always, discover and disclose responsibly! 🤓
Table of Contents
Section titled “Table of Contents”- Industrial Control Systems
- Remote Desktop
- Network Infrastructure
- Network Attached Storage (NAS)
- Webcams
- Printers & Copiers
- Home Devices
- Random Stuff
Industrial Control Systems
Section titled “Industrial Control Systems”Samsung Electronic Billboards 🔎 →
Section titled “Samsung Electronic Billboards 🔎 →”"Server: Prismview Player"
Gas Station Pump Controllers 🔎 →
Section titled “Gas Station Pump Controllers 🔎 →”"in-tank inventory" port:10001
Automatic License Plate Readers 🔎 →
Section titled “Automatic License Plate Readers 🔎 →”P372 "ANPR enabled"
Traffic Light Controllers / Red Light Cameras 🔎 →
Section titled “Traffic Light Controllers / Red Light Cameras 🔎 →”mikrotik streetlightVoting Machines in the United States 🔎 →
Section titled “Voting Machines in the United States 🔎 →”"voter system serial" country:USTelcos Running Cisco Lawful Intercept Wiretaps 🔎 →
Section titled “Telcos Running Cisco Lawful Intercept Wiretaps 🔎 →”"Cisco IOS" "ADVIPSERVICESK9_LI-M"Wiretapping mechanism outlined by Cisco in RFC 3924:
Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term “intercept subject” […] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.
Prison Pay Phones 🔎 →
Section titled “Prison Pay Phones 🔎 →”"[2J[H Encartele Confidential"http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Electric Vehicle Chargers 🔎 →
Section titled “Electric Vehicle Chargers 🔎 →”"Server: gSOAP/2.8" "Content-Length: 583"Maritime Satellites 🔎 →
Section titled “Maritime Satellites 🔎 →”Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!
"Cobham SATCOM" OR ("Sailor" "VSAT")
Submarine Mission Control Dashboards 🔎 →
Section titled “Submarine Mission Control Dashboards 🔎 →”title:"Slocum Fleet Mission Control"CAREL PlantVisor Refrigeration Units 🔎 →
Section titled “CAREL PlantVisor Refrigeration Units 🔎 →”"Server: CarelDataServer" "200 Document follows"
http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"C4 Max Commercial Vehicle GPS Trackers 🔎 →
Section titled “C4 Max Commercial Vehicle GPS Trackers 🔎 →”"[1m[35mWelcome on console"
DICOM Medical X-Ray Machines 🔎 →
Section titled “DICOM Medical X-Ray Machines 🔎 →”Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.
"DICOM Server Response" port:104GaugeTech Electricity Meters 🔎 →
Section titled “GaugeTech Electricity Meters 🔎 →”"Server: EIG Embedded Web Server" "200 Document follows"
Siemens Industrial Automation 🔎 →
Section titled “Siemens Industrial Automation 🔎 →”"Siemens, SIMATIC" port:161Siemens HVAC Controllers 🔎 →
Section titled “Siemens HVAC Controllers 🔎 →”"Server: Microsoft-WinCE" "Content-Length: 12581"Door / Lock Access Controllers 🔎 →
Section titled “Door / Lock Access Controllers 🔎 →”"HID VertX" port:4070Railroad Management 🔎 →
Section titled “Railroad Management 🔎 →”"log off" "select the appropriate"Remote Desktop
Section titled “Remote Desktop”Unprotected VNC 🔎 →
Section titled “Unprotected VNC 🔎 →”"authentication disabled" "RFB 003.008"Shodan Images is a great supplementary tool to browse screenshots, by the way! 🔎 →
The first result right now. 😞
Windows RDP 🔎 →
Section titled “Windows RDP 🔎 →”99.99% are secured by a secondary Windows login screen.
"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"Network Infrastructure
Section titled “Network Infrastructure”Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.
title:"Weave Scope" http.favicon.hash:567176827
MongoDB 🔎 →
Section titled “MongoDB 🔎 →”Older versions were insecure by default. Very scary.
"MongoDB Server Information" port:27017 -authentication
Like the infamous phpMyAdmin but for MongoDB.
"Set-Cookie: mongo-express=" "200 OK"
Jenkins CI 🔎 →
Section titled “Jenkins CI 🔎 →”"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Docker APIs 🔎 →
Section titled “Docker APIs 🔎 →”"Docker Containers:" port:2375Docker Private Registries 🔎 →
Section titled “Docker Private Registries 🔎 →”"Docker-Distribution-Api-Version: registry" "200 OK" -gitlabPi-hole Open DNS Servers 🔎 →
Section titled “Pi-hole Open DNS Servers 🔎 →”"dnsmasq-pi-hole" "Recursion: enabled"Already Logged-In as root via Telnet 🔎 →
Section titled “Already Logged-In as root via Telnet 🔎 →”"root@" port:23 -login -password -name -SessionAndroid Root Bridges 🔎 →
Section titled “Android Root Bridges 🔎 →”A tangential result of Google’s sloppy fractured update approach. 🙄 More information here.
"Android Debug Bridge" "Device" port:5555Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords 🔎 →
Section titled “Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords 🔎 →”Lantronix password port:30718 -securedCitrix Virtual Apps 🔎 →
Section titled “Citrix Virtual Apps 🔎 →”"Citrix Applications:" port:1604
Cisco Smart Install 🔎 →
Section titled “Cisco Smart Install 🔎 →”Vulnerable (kind of “by design,” but especially when exposed).
"smart install client active"PBX IP Phone Gateways 🔎 →
Section titled “PBX IP Phone Gateways 🔎 →”PBX "gateway console" -password port:23Polycom Video Conferencing 🔎 →
Section titled “Polycom Video Conferencing 🔎 →”http.title:"- Polycom" "Server: lighttpd"Telnet Configuration: 🔎 →
"Polycom Command Shell" -failed port:23
"Server: Bomgar" "200 OK"Intel Active Management CVE-2017-5689 🔎 →
Section titled “Intel Active Management CVE-2017-5689 🔎 →”"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900Outlook Web Access:
Section titled “Outlook Web Access:”Exchange 2007 🔎 →
Section titled “Exchange 2007 🔎 →”"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Exchange 2010 🔎 →
Section titled “Exchange 2010 🔎 →”"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Exchange 2013 / 2016 🔎 →
Section titled “Exchange 2013 / 2016 🔎 →”"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Lync / Skype for Business 🔎 →
Section titled “Lync / Skype for Business 🔎 →”"X-MS-Server-Fqdn"Network Attached Storage (NAS)
Section titled “Network Attached Storage (NAS)”SMB (Samba) File Shares 🔎 →
Section titled “SMB (Samba) File Shares 🔎 →”Produces ~500,000 results…narrow down by adding “Documents” or “Videos”, etc.
"Authentication: disabled" port:445Specifically domain controllers: 🔎 →
"Authentication: disabled" NETLOGON SYSVOL -unix port:445Concerning default network shares of QuickBooks files: 🔎 →
"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445FTP Servers with Anonymous Login 🔎 →
Section titled “FTP Servers with Anonymous Login 🔎 →”"220" "230 Login successful." port:21Iomega / LenovoEMC NAS Drives 🔎 →
Section titled “Iomega / LenovoEMC NAS Drives 🔎 →”"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Buffalo TeraStation NAS Drives 🔎 →
Section titled “Buffalo TeraStation NAS Drives 🔎 →”Redirecting sencha port:9000
Logitech Media Servers 🔎 →
Section titled “Logitech Media Servers 🔎 →”"Server: Logitech Media Server" "200 OK"
Plex Media Servers 🔎 →
Section titled “Plex Media Servers 🔎 →”"X-Plex-Protocol" "200 OK" port:32400"CherryPy/5.1.0" "/home"
Webcams
Section titled “Webcams”Example images not necessary. 🤦
Yawcams 🔎 →
Section titled “Yawcams 🔎 →”"Server: yawcam" "Mime-Type: text/html"webcamXP/webcam7 🔎 →
Section titled “webcamXP/webcam7 🔎 →”("webcam 7" OR "webcamXP") http.component:"mootools" -401Android IP Webcam Server 🔎 →
Section titled “Android IP Webcam Server 🔎 →”"Server: IP Webcam Server" "200 OK"Security DVRs 🔎 →
Section titled “Security DVRs 🔎 →”html:"DVR_H264 ActiveX"Printers & Copiers:
Section titled “Printers & Copiers:”HP Printers 🔎 →
Section titled “HP Printers 🔎 →”"Serial Number:" "Built:" "Server: HP HTTP"
Xerox Copiers/Printers 🔎 →
Section titled “Xerox Copiers/Printers 🔎 →”ssl:"Xerox Generic Root"
Epson Printers 🔎 →
Section titled “Epson Printers 🔎 →”"SERVER: EPSON_Linux UPnP" "200 OK""Server: EPSON-HTTP" "200 OK"
Canon Printers 🔎 →
Section titled “Canon Printers 🔎 →”"Server: KS_HTTP" "200 OK""Server: CANON HTTP Server"
Home Devices
Section titled “Home Devices”Yamaha Stereos 🔎 →
Section titled “Yamaha Stereos 🔎 →”"Server: AV_Receiver" "HTTP/1.1 406"
Apple AirPlay Receivers 🔎 →
Section titled “Apple AirPlay Receivers 🔎 →”Apple TVs, HomePods, etc.
"\x08_airplay" port:5353Chromecasts / Smart TVs 🔎 →
Section titled “Chromecasts / Smart TVs 🔎 →”"Chromecast:" port:8008"Model: PYNG-HUB"Random Stuff
Section titled “Random Stuff”OctoPrint 3D Printer Controllers 🔎 →
Section titled “OctoPrint 3D Printer Controllers 🔎 →”title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Etherium Miners 🔎 →
Section titled “Etherium Miners 🔎 →”"ETH - Total speed"
Apache Directory Listings 🔎 →
Section titled “Apache Directory Listings 🔎 →”Substitute .pem with any extension or a filename like phpinfo.php.
http.title:"Index of /" http.html:".pem"Misconfigured WordPress 🔎 →
Section titled “Misconfigured WordPress 🔎 →”Exposed wp-config.php files containing database credentials.
http.html:"* The wp-config.php creation script uses this file"Too Many Minecraft Servers 🔎 →
Section titled “Too Many Minecraft Servers 🔎 →”"Minecraft Server" "protocol 340" port:25565Literally Everything in North Korea 🇰🇵 🔎 →
Section titled “Literally Everything in North Korea 🇰🇵 🔎 →”net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24TCP Quote of the Day 🔎 →
Section titled “TCP Quote of the Day 🔎 →”Port 17 (RFC 865) has a bizarre history…
port:17 product:"Windows qotd"Find a Job Doing This! 👩💼 🔎 →
Section titled “Find a Job Doing This! 👩💼 🔎 →”"X-Recruiting:"If you’ve found any other juicy Shodan gems, whether it’s a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.
Bon voyage, fellow penetrators! 😉
License
Section titled “License”
To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.
Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.
HagiCode
HagiCode is an agentic coding workspace. Rich, convenient UI interactions make planning, agent execution, and project work approachable and easy to navigate, creating an engaging development experience.
Explore an engaging development experience through rich, convenient UI interactions.
- SmartOpenSpec workflows turn intent into an executable path, from proposal to design, tasks, and a shipped change.
- EfficientMulti-agent execution keeps research, implementation, and review moving in parallel, across several repositories and the Agent CLIs you already use.
- InterestingRich, convenient UI interactions make planning, agent execution, and project work approachable and easy to navigate.
Download for Windows
Share HagiCode
Turn ideas into shipped software.
HagiCode is an agentic coding workspace. OpenSpec workflows plan the change, multi-agent execution carries it out, and Hero Scenario makes the long run visible, so ideas become shipped software.
- Smart
- OpenSpec workflows turn intent into a path from proposal to shipped change.
- Efficient
- Multi-agent execution runs research, build, and review in parallel.
- Fun
- Rich UI interactions make planning, agent work, and projects easier to follow.
© 2026 HagiCode | Powered By hagilight-starlight@0.21.0 | Branch: main | Commit: 745b50b | Built: